One user?
Compare identity and permissions
If everyone else can use the same system, focus on the affected user's identity, license, group membership, credentials, permissions, profile, or user-specific configuration.
Everyday IT · Troubleshooting Method
Find the blast radius before you change anything.
The fastest troubleshooting question is often not “what is broken?” It is “who and what is affected?”One user, one device, one location, one resource, or everyone?
The five scope questions
Each answer removes entire categories of possible causes.
One device?
Compare the workstation
If the same user succeeds elsewhere, move toward the local client, cached credentials, device configuration, drivers, profile, network stack, or hardware.
One location?
Compare the network path
If the same account and device work from another network, investigate local Internet, DNS, routing, firewall filtering, VPN reachability, wireless, or site-specific infrastructure.
One resource?
Compare the destination
If other internal resources work, isolate the server, share, mailbox, site, application, printer, scanner, or service that is failing.
Everyone?
Look for the shared layer
When multiple users or devices fail at once, move upstream toward service health, network infrastructure, authentication services, servers, appliances, or a common configuration change.
Use controlled comparisons
A good comparison changes one variable at a time.
Same user
Different device
If the user works on another computer or in the browser, the original device or client becomes a stronger suspect.
Same device
Different user
If another known-good user succeeds on the same device, investigate the affected identity, permission, or user profile before rebuilding the machine.
Same account
Different network
If a remote service works from another location, the failing network path deserves attention before password resets or client reinstalls.
Same path
Different resource
If VPN is connected and one server works while another does not, the tunnel itself may not be the failing layer.
What scope tells you
Scope does not give you the root cause. It tells you where to spend the next five minutes.
User-specific
Identity path
Check account state, password, MFA, licensing, delegation, groups, token refresh, permissions, and user-specific application state.
Device-specific
Endpoint path
Check profile, application state, saved credentials, drivers, services, updates, local network configuration, performance, and hardware.
Location-specific
Network path
Check DNS, routing, Internet reachability, wireless, local firewall behavior, VPN endpoint access, and site infrastructure.
Widespread
Shared-service path
Check outages, servers, directory services, firewalls, cloud service health, common configuration changes, and infrastructure alerts.
Avoid contaminating the test
Large changes destroy useful comparison evidence.
Do not
Reset everything at once
Password reset, profile rebuild, client reinstall, network reset, and permission changes done together may make the symptom disappear without telling you what was actually wrong.
Do not
Assume the error text identifies the layer
Users and applications often report the symptom at the top of the stack. A credential-looking error can still begin with a reachability or backend problem.
Do
Change one meaningful variable
Use the result of each comparison to decide the next test. Troubleshooting should narrow the tree, not shake the whole tree at once.
Scope first. Layer second. Change third.
The smaller the blast radius becomes, the safer and faster the next action becomes.
Related Guides
Continue with the smallest test the scope supports.
Use a known-good comparison
Hold one variable constant to isolate user, device, network, or resource state. Compare deliberately
Plan the change and rollback
Define impact and recovery before changing the layer you isolated. Prepare the change
Escalate with evidence
If scope reveals shared infrastructure, security, data, privilege, or business-wide risk, preserve the finding. Build the escalation